Azure Active Directory
Welcome to the Azure Active Directory suggestions and feedback site! We love hearing from you. If you have suggestions, please submit an idea or vote up an idea. We are monitoring the site actively.
Thank you for joining our community and helping improve Azure AD!
Wehave a new log in experience integrated with Azure AD, and we stronglyrecommend you log in with your Azure AD (Office 365) account. If yourUserVoice account is the same email address as your Azure AD account, yourprevious activities will be automatically mapped to your Azure AD account. You can read more here for details: https://techcommunity.microsoft.com/t5/Azure-Active-Directory-Identity/Putting-customers-first-for-f...
-
Allow more customization of the myapps.microsoft.com portal.
Would be great if I could forward a subdomain to our myapps.microsoft.com portal. Instead of giving users a the microsoft.com URL, I want to give them one.theblaze.com.
Second, would be great if there was a newsfeed widget at the top of the portal that could show an RSS feed of company news.
118 votesThanks so much for the feedback! Customizations of the My Apps portal for both end users and admins are on our roadmap. This includes providing the ability to re-arrange and group apps and as well as using a customizable domain.
We are also looking to see if we can enable embedding other components like widgets. We’re still in process of validating options for this.
Please keep sharing your feedback and ideas around this! -
AADB2C: How-to on multi-tenant applications based on B2C
As service provider using Azure as the underlying platform, I want to create an application that allows companies to create and manage their tenants and users within my service in order to provide a public service area as well as a privately owned area for the company.
I've read about B2C supporting multi-tenant, but I couldn't find hints within the documentation...
116 votesWe are currently prioritizing Azure AD as and identity provider into B2C. We will review this request after that work is done. Keep the requests coming! /Jose Rojas
-
Enable PIM role assignment by Group membership.
It would be nice to enable PIM roles to be linked not only to direct assignment to users but also to groups. This enables integration with on-premise IAM solutions that have not been extended to support the Graph API calls to PIM for role management.
111 votes -
Getting more granular permissions with Graph API and SPO sites
Do we have any plans to allow Azure AD-registered apps accessing Microsoft Graph APIs (such as SharePoint Online) to have more granular permissions? Can we get SharePoint Online (SPO) to enforce more granular authorization rules based on the app identity and some manifest rules to restrict the site collection for example, instead of Sites.Read.All? I am looking for something like this: https://docs.microsoft.com/en-us/sharepoint/dev/solution-guidance/security-apponly-azureacs, but for Azure-AD apps (where we can specify really granular permissions).
This question is around the ability to customize Microsoft Graph APIs such as SharePoint Online APIs to restrict the site collections that can be accessed by…
110 votes -
Utilize AAD Security Groups for Device "Additional Local Administrators" support
Emulating the Intune Roles method with Assignments, Members and Scopes would be ideal. Also the ability to disable Global Admin access (limit to groups/scopes added).
110 votesWe’re currently working on this capability and will provide an update when it’s done.
However, instead of expanding the “Additional Local administrators” setting, we will support adding AAD groups to Windows 10 local groups (.e.g Administrators, Remote Desktop Users) via MDM policy and elevate user privileges on logon. This will provide greater flexibility to assign different groups to different devices
—
Ravi -
CORS for App Proxy
There should be CORS setting available on App Proxy just like we have the CORS available for App Services.
Making calls from Azure Apps into an Azure App Proxy App is a very common scenario, especially when on-prem applications are surfaced externally using App proxy.
More details - http://stackoverflow.com/questions/43955808/cors-prelight-issue
110 votesWe are looking at enabling a feature that focuses on supporting CORS preflight requests between two applications. This works by allowing you to configure the response and have App Proxy handle it on behalf of the app.
A pre-requisite for this feature to work is that the user must be able to authenticate into the second application in order to avoid a CORS issue from the login flow into the second app.
To avoid this the user will have to make sure they have already accessed the 2nd application before the CORS request, and has valid credentials. This should work for wildcard apps and can also be achieved by adding a fake link / image to the 2nd application in the first application.We would love to get your feedback on this requirement and if this is something that will fit your use case.
-
Add reporting to see how many users have or have not registered for Self Service Password Reset.
Would be helpful so we know who to target to get them registered within our organization
110 votesHi folks! This feature is still in progress and will go to public preview soon. I will update this request once it’s in public preview. I apologize for the delay – we know how important this is!
-
Enable SSPR to reset Windows cached credentials
In reference to - https://docs.microsoft.com/en-us/azure/active-directory/authentication/tutorial-sspr-windows
Its great that SSPR can now be invoked from the login screen. This however seems like a relatively minor benefit to the average user since most have a mobile device with which they can follow the flow. I don't mean to demean the achievement since its definitely needed. However, what is a major issue (and which generates just as many support issues (and erodes IT credibility) as no SSPR at all) is the lack of SSPR for cached credentials when users are off the network/VPN. This happens to be the most common use case we…
108 votesHey folks! Thank you for your feedback. We are reviewing this ask and will keep you up to date on our findings. We have also added information about this limitation in our documentation. Thank you!
-
Recycle Bin For Deleted Devices
Would be great if there was a recover-msoldevice cmdlet or some way to recover a bitlocker recovery key after a device was deleted.
107 votes -
AD Groups in Application Owners
Would be great to be able to add groups to application owners in AD instead of only users. Scenario is to use on-prem AD synced with Azure to keep management of application roles/groups/etc on-prem for cloud hosted solutions.
Thanks!
107 votes -
B2C Roadmap
Deliver a roadmap which shows what functionality is planned and under review.
105 votesHi all, unfortunately we don’t have plans to share out a public roadmap. This is constantly changing as we’re listening to customer requests. We will continue to update feedback.azure items as they come up so feel free to suggest anything you are curious about.
-
Support for multi-valued attributes synchronized from on premises AD
AD Connect supports synchronizing multi-valued attributes to AAD.
However, AAD doesn't support multi-valued attributes synchronized from on premises AD.Would be great to have this supported so that for example Dynamic Groups can use multi-value attributes for group membership rules.
104 votesWe are investigating what it would take to add support for multi-value attributes in Dynamic Groups to enable this and related scenarios.
Kristina Bain Smith
-
Sync "Account Expired" UserAccountControl to Azure AD (AccountEnabled)
Consider adding support for disabling user accounts in Azure Active Directory when the account is expired in the local Active Directory. Currently you recommend that customers create a PowerShell script that disable user accounts in Active Directory to support this scenario.
I would prefer that a rule be added to Azure Active Directory Connect that automatically changes AccountEnabled to false, if the users account expires in the local Active Directory.
Aaron posted a great workaround solution:
https://blogs.technet.microsoft.com/undocumentedfeatures/2017/09/15/use-aad-connect-to-disable-accounts-with-expired-on-premises-passwords/We would like something built-in Active AD Connect that solves this out of the box
104 votesWe are currently investigating how to implement this. The expiration status is not a directory attribute so it is not straight forward how to sync it.
-
Get 'low license count' notification
It would be beneficial to get a notification when license count gets to x number. We are syncing our users with DirSync and apply licenses based on group membership. When users get synced and we have no licenses, I have zero idea until someone comes to me that they cannot get logged in to O365.
102 votes -
Go Direct to Password Reset from Sign-In/Sign-Up
The Sign-in only policy allows the user to go directly to the password reset.
The Sign-in/Sign-Up does not allow this. The user gets redirected back and you have to handle AADB2C90118.
While this flow is useful for some people the opposite is also true. Please allow me to specify the password reset policy in my sign-in/sign-up policy so the round trip is not required if I don't want it.
102 votesWe have started working on this feature and hope to have another update by Oct 2018.
/Parakh
-
Add Multifactor Authentication (MFA) support for DirectAccess remote technology
One Time Password access to the DirectAccess user tunnel using MFA
102 votesPlease provide more details. DirectAccess is an on-premises technology and as such may not fall into Azure Active Directory.
-
Support for 3rd party EMM solutions when requiring device compliance
We use Airwatch for managing mobile devices. We want to use conditional access policies to ensure the device has been marked as compliant by Airwatch before allowing access to certain applications.
Currently Azure AD Conditional Access Policies only supports InTune for checking device compliance as described @ https://docs.microsoft.com/en-us/azure/active-directory/active-directory-conditional-access-policy-connected-applications#trusted-devices. This should be extended to support 3rd party EMM solutions.
101 votes -
Set MFA using Azure Active Directory Powershell Module
Add support in Azure Active Directory PowerShell module to set Multi-Factor Authentication (MFA).
Thanks
100 votes -
Custom password complexity
Allow the ability to set different password complexities for local accounts in a B2C tenant.
100 votesWe have a private preview of this feature available. If you are interested in joining, please contact aadb2cpreview@microsoft.com with the name of your tenant.
/Sam
-
AADB2C: include username in JWT claims
AADB2C supports either email addresses or usernames for accounts. If a directory uses usernames, you don't get that username as a claim in the JWT. This means an extra trip to Azure must be made to retrieve the username. Please consider including the username in the JWT.
98 votesThis is currently not on our roadmap. You can retrieve this value by making a call through the Graph API. If this is needed for your scenarios, please continue voting and we will review at a later date.
- Don't see your idea?